Set Sec-Fetch-Dest to email-verification for those requests [chromium/src : main]

0 views
Skip to first unread message

Nicolás Peña (Gerrit)

unread,
Oct 30, 2025, 1:30:17 PM (24 hours ago) Oct 30
to Christian Biesinger, chromium...@chromium.org, Kaan Icer, Nate Chapin, blink-...@chromium.org, chromium-a...@chromium.org, dmurph+watching...@chromium.org, edgesto...@microsoft.com, extension...@chromium.org, gavinp...@chromium.org, ipc-securi...@chromium.org, jmedle...@chromium.org, kinuko...@chromium.org, loading-re...@chromium.org, loading...@chromium.org, network-ser...@chromium.org, npm+...@chromium.org, storage...@chromium.org, yigu+...@chromium.org
Attention needed from Christian Biesinger

Nicolás Peña voted Commit-Queue+1

Commit-Queue+1
Open in Gerrit

Related details

Attention is currently required from:
  • Christian Biesinger
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I6d2f4e5d36f0a3e0fafd64a8aa326c283a7cd898
Gerrit-Change-Number: 7101621
Gerrit-PatchSet: 2
Gerrit-Owner: Nicolás Peña <n...@chromium.org>
Gerrit-Reviewer: Christian Biesinger <cbies...@chromium.org>
Gerrit-Reviewer: Nicolás Peña <n...@chromium.org>
Gerrit-CC: Kaan Icer <ic...@chromium.org>
Gerrit-CC: Nate Chapin <jap...@chromium.org>
Gerrit-Attention: Christian Biesinger <cbies...@chromium.org>
Gerrit-Comment-Date: Thu, 30 Oct 2025 17:30:13 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
satisfied_requirement
unsatisfied_requirement
open
diffy

Christian Biesinger (Gerrit)

unread,
Oct 30, 2025, 2:34:16 PM (23 hours ago) Oct 30
to Nicolás Peña, Chromium LUCI CQ, Christian Biesinger, chromium...@chromium.org, Kaan Icer, Nate Chapin, blink-...@chromium.org, chromium-a...@chromium.org, dmurph+watching...@chromium.org, edgesto...@microsoft.com, extension...@chromium.org, gavinp...@chromium.org, ipc-securi...@chromium.org, jmedle...@chromium.org, kinuko...@chromium.org, loading-re...@chromium.org, loading...@chromium.org, network-ser...@chromium.org, npm+...@chromium.org, storage...@chromium.org, yigu+...@chromium.org
Attention needed from Nicolás Peña

Christian Biesinger added 7 comments

Patchset-level comments
Commit Message
Line 7, Patchset 2 (Latest):Set Sec-Fetch-Dest to email-verification for those requests
Christian Biesinger . unresolved

Maybe add a link to https://github.com/WICG/email-verification-protocol in the description

File content/browser/webid/idp_network_request_manager.h
Line 371, Patchset 2 (Latest): network::mojom::RequestDestination destination,
Christian Biesinger . unresolved

why this change? isn't this always WebIdentity?

File content/browser/webid/idp_network_request_manager.cc
Line 1044, Patchset 2 (Latest): network::mojom::RequestDestination::kWebIdentity,
Christian Biesinger . unresolved

I almost wonder if this should be a constructor argument, since the IDP subclass always uses webidentity and the email verification subclass alwas uses email verification

File content/browser/webid/idp_network_request_manager_unittest.cc
Line 979, Patchset 2 (Latest):TEST_F(IdpNetworkRequestManagerTest, FetchWellKnownRequestDestination) {
File services/network/public/cpp/request_destination.cc
Line 47, Patchset 2 (Latest):constexpr char kEmailVerification[] = "email-verification";
Christian Biesinger . unresolved

No other destination uses a dash, I don't think this one should be the exception

File third_party/blink/renderer/core/fetch/request.idl
Line 28, Patchset 2 (Latest): "email-verification",
Christian Biesinger . unresolved

Weird, not sure why https://crrev.com/c/5925915 added webidentity here, the renderer should never see it.

Anyway, this should probably not be under the FedCM heading, maybe link to https://github.com/WICG/email-verification-protocol ?

Open in Gerrit

Related details

Attention is currently required from:
  • Nicolás Peña
Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement is not satisfiedCode-Owners
    • requirement is not satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: I6d2f4e5d36f0a3e0fafd64a8aa326c283a7cd898
    Gerrit-Change-Number: 7101621
    Gerrit-PatchSet: 2
    Gerrit-Owner: Nicolás Peña <n...@chromium.org>
    Gerrit-Reviewer: Christian Biesinger <cbies...@chromium.org>
    Gerrit-Reviewer: Nicolás Peña <n...@chromium.org>
    Gerrit-CC: Kaan Icer <ic...@chromium.org>
    Gerrit-CC: Nate Chapin <jap...@chromium.org>
    Gerrit-Attention: Nicolás Peña <n...@chromium.org>
    Gerrit-Comment-Date: Thu, 30 Oct 2025 18:34:11 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: No
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Nicolás Peña (Gerrit)

    unread,
    Oct 30, 2025, 6:42:50 PM (18 hours ago) Oct 30
    to Chromium LUCI CQ, Christian Biesinger, chromium...@chromium.org, Kaan Icer, Nate Chapin, blink-...@chromium.org, chromium-a...@chromium.org, dmurph+watching...@chromium.org, edgesto...@microsoft.com, extension...@chromium.org, gavinp...@chromium.org, ipc-securi...@chromium.org, jmedle...@chromium.org, kinuko...@chromium.org, loading-re...@chromium.org, loading...@chromium.org, network-ser...@chromium.org, npm+...@chromium.org, storage...@chromium.org, yigu+...@chromium.org
    Attention needed from Christian Biesinger

    Nicolás Peña voted and added 7 comments

    Votes added by Nicolás Peña

    Commit-Queue+1

    7 comments

    Patchset-level comments
    Christian Biesinger . resolved

    You should probably add email verification to https://source.chromium.org/chromium/chromium/src/+/main:services/network/cors/cors_url_loader_factory.cc;l=767 as well

    Nicolás Peña

    Done

    Commit Message
    Line 7, Patchset 2:Set Sec-Fetch-Dest to email-verification for those requests
    Christian Biesinger . resolved

    Maybe add a link to https://github.com/WICG/email-verification-protocol in the description

    Nicolás Peña

    Done

    File content/browser/webid/idp_network_request_manager.h
    Line 371, Patchset 2: network::mojom::RequestDestination destination,
    Christian Biesinger . resolved

    why this change? isn't this always WebIdentity?

    Nicolás Peña

    Done

    File content/browser/webid/idp_network_request_manager.cc
    Line 1044, Patchset 2: network::mojom::RequestDestination::kWebIdentity,
    Christian Biesinger . resolved

    I almost wonder if this should be a constructor argument, since the IDP subclass always uses webidentity and the email verification subclass alwas uses email verification

    Nicolás Peña

    Oh good idea. Done

    File content/browser/webid/idp_network_request_manager_unittest.cc
    Line 979, Patchset 2:TEST_F(IdpNetworkRequestManagerTest, FetchWellKnownRequestDestination) {
    Christian Biesinger . resolved
    Nicolás Peña

    Acknowledged

    File services/network/public/cpp/request_destination.cc
    Line 47, Patchset 2:constexpr char kEmailVerification[] = "email-verification";
    Christian Biesinger . unresolved

    No other destination uses a dash, I don't think this one should be the exception

    Nicolás Peña

    Hmm maybe it should be `emailverification`?

    File third_party/blink/renderer/core/fetch/request.idl
    Line 28, Patchset 2: "email-verification",
    Christian Biesinger . resolved

    Weird, not sure why https://crrev.com/c/5925915 added webidentity here, the renderer should never see it.

    Anyway, this should probably not be under the FedCM heading, maybe link to https://github.com/WICG/email-verification-protocol ?

    Nicolás Peña

    I guess we can add notreached for these in the converter since it is only used for the request destination attribute getter which should never return these... Done

    Open in Gerrit

    Related details

    Attention is currently required from:
    • Christian Biesinger
    Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement is not satisfiedCode-Owners
    • requirement is not satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: I6d2f4e5d36f0a3e0fafd64a8aa326c283a7cd898
    Gerrit-Change-Number: 7101621
    Gerrit-PatchSet: 4
    Gerrit-Owner: Nicolás Peña <n...@chromium.org>
    Gerrit-Reviewer: Christian Biesinger <cbies...@chromium.org>
    Gerrit-Reviewer: Nicolás Peña <n...@chromium.org>
    Gerrit-CC: Kaan Icer <ic...@chromium.org>
    Gerrit-CC: Nate Chapin <jap...@chromium.org>
    Gerrit-Attention: Christian Biesinger <cbies...@chromium.org>
    Gerrit-Comment-Date: Thu, 30 Oct 2025 22:42:44 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: Yes
    Comment-In-Reply-To: Christian Biesinger <cbies...@chromium.org>
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy
    Reply all
    Reply to author
    Forward
    0 new messages